Verifying webhook signatures

Because your webhook URL is reachable by anyone, you must verify that each request is genuinely from New Venue Data before acting on it. We sign every delivery with a secret that only you and we know.

The signature header

Every delivery includes an X-LS-Signature header. It is an HMAC-SHA256 of the raw request body, keyed with your endpoint signing secret (found next to the webhook in Settings).

Verifying it

import crypto from "crypto"

function verify(rawBody, header, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex")
  return crypto.timingSafeEqual(
    Buffer.from(header),
    Buffer.from(expected)
  )
}

Critical details

• Compute the HMAC over the raw, unparsed body — JSON re-serialization changes bytes and breaks the check.
• Use a constant-time comparison to avoid timing attacks.
• Reject the request if verification fails, and never log the signing secret.